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1.1 . (SBU)  SUMMARY:  The  experience  of  unprecedented  and  wide- 
spread cyber  attacks  in  April/May  2007  prompted  Estonia  to 
accelerate  its  leadership  efforts  in  promoting 
international  cooperation  on  cyber  security.  The 
Government  of  Estonia  (GOE)  is  working  with  NATO  to  make 
its  national  Cooperative  Cyber  Defense  Center  (CCD)  a NATO 
Center  of  Excellence  (COE)  and  is  actively  seeking  U.S.  and 
other  Allied  sponsorship  of  the  Center.  U.S.  sponsorship 
of  Estonia's  CCD-COE  would  not  only  enhance  Estonia's 
efforts  to  provide  expertise  and  support  to  NATO's 
developing  cyber  security  doctrine,  but  will  also  encourage 
other  Allies  to  participate  in  the  Center.  End  Summary. 

Background 


1.2.  (SBU)  In  April/May  2007,  cyber  attackers  targeted 
government  and  private  sector  websites  in  Estonia.  The 
attacks,  which  lasted  for  approximately  one  month  and 
ranged  from  simple  spam  postings  to  coordinated  DDOS 
(Distributed  Denial  of  Service)  attacks,  caused  severe 
service  disruptions  to  websites,  servers  and  routers  linked 
to  government,  banking,  media  and  other  resources.  (Refs  A 
and  B).  These  highly  coordinated  cyber  attacks  captured 
widespread  international  media  attention.  The  United 
States  and  NATO  quickly  sent  experts  to  Tallinn  to  observe 
and  provide  a summary  of  the  attacks  and  the  GOE  response. 
Since  the  attacks,  the  GOE  has  actively  sought  a leadership 
role  on  cyber  security  within  NATO,  the  European  Union  (EU) 
and  other  organizations.  As  a result,  Estonia  has  emerged 
as  an  important  player  in  international  cooperation  on 
cyber  defense. 

13.  (SBU)  The  attacks  on  Estonia  demonstrated  the 
vulnerability  of  both  government  and  private  sector 
Internet  infrastructure  to  cyber  warfare  and  revealed  the 
need  for  better  international  cooperation  on  cyber 
security.  The  GOE  has  advocated  in  favor  of  the 
establishment  of  an  international  legal  framework  on  cyber 
security.  Currently,  cyber  cooperation  is  done  on  an 
almost  exclusively  ad-hoc  basis.  In  January  2008,  NATO 
approved  a cyber-defense  policy  (Estonian  and  US  officials 
at  NATO  worked  closely  as  this  policy  took  shape)  that 
strengthens  and  streamlines  NATO's  internal  cyber  defenses 
and  establishes  a capability  to  assist  Allies  under  cyber 
attack . 

14.  (SBU)  In  2004,  the  GOE  offered  to  host  the  CCD  COE  in 
Tallinn.  Development  was  initiated  in  2005  and  NATO 


Supreme  Allied  Command  Transformation  (SACT)  approval  came 
in  2006.  The  mission  of  the  CCD  COE  is  to  enhance  the 
cooperative  cyber  defense  capability  of  NATO  and  to  become 
an  important  source  of  expertise  for  NATO  in  cooperative 
cyber  defense-related  matters.  Estonia  is  working  to  have 
the  COE  accredited  by  NATO  by  December  2008. 

15.  (SBU)  In  November  2007,  the  USG  was  the  first  Ally  to 
send  a representative  to  the  CCD  - the  Department  of  the 
Navy  seconded  a cyber  security  expert  from  the  Naval 
Criminal  Investigative  Service  (NCIS)  to  the  CCD  for  one 
year.  (Note:  The  CCD  NCIS  representative's  assignment  to 
the  CCD  will  be  reevaluated  by  the  Navy  at  the  end  of  one 
year  and  may  be  transformed  into  a three  year  tour.  End 
Note . ) 

MOU  Conference 


1.6.  (SBU)  In  late  January  2008,  the  Estonian  Ministry  of 
Defense  (MOD)  hosted  a conference  in  Tallinn  to  negotiate 
the  Memorandum  of  Understanding  (MOU)  that  will  govern 
participation  in  the  CCD-COE.  Representatives  from  NATO 
SACT  and  ten  Allies  took  part  in  the  conference.  Estonia, 
Italy,  Germany,  Latvia,  Lithuania,  Slovakia  and  Spain 
participated  as  likely  'sponsoring  nations'  (SNs)  while  the 
Czech  Republic,  Norway,  Poland  and  the  United  States  sent 
observers.  (Note:  Bulgaria's  observer  could  not  come  as 

planned.  Denmark,  listed  as  a sponsor  nation  on  the  MOU 
working  documents,  did  not  send  a representative  to  the 
conference  and  has  decided  not  to  participate  in  the  CCD- 
COE  at  this  time.  End  Note.)  The  NCIS  Rep  to  the  CCD  and 
Poloff  attended  the  conference. 

17 . (SBU)  The  conference  focused  on  finalizing  the  texts  of 
the  MOUs  so  that  internal  staffing  could  be  completed  in 
time  for  a May  2008  signing  ceremony  and  NATO  accreditation 
by  December  2008.  Both  Germany  and  Latvia  commented  they 
thought  it  would  be  difficult  to  finalize  staffing 
according  to  the  proposed  schedule.  Slovakia  also  raised 
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concerns  about  the  stipulation  in  the  draft  MOU  that  all 
SNs  must  have  at  least  one  representative  at  the  Center  in 
Estonia  and  said  this  stipulation  could  result  in 
Slovakia's  withdrawal  as  a SN.  NATO  SACT  and  Estonia  said 
that  the  issue  is  non-negotiable : to  be  a Sponsoring 

Nation,  there  is  a requirement  to  have  someone  on  the 
ground . 

18.  Conference  participants  also  addressed  budget  and 
resources  issues  and  discussed  the  extent  to  which  NATO 
command  would  influence  the  Plan  of  Work  and  operations  of 
the  CCD-COE.  Estonia  pledged  to  cover  the  EUR  300,000 
operating  budget  for  2008.  Starting  in  2009,  however,  each 
SN  will  be  asked  to  contribute  approximately  EUR  20,000. 

1.9 . (U)  One  issue  still  to  be  resolved  is  the  level  of 
access  Allies  who  are  not  SNs  will  have  to  the  CCD-COE ' s 
products  and  services.  Both  Lithuania  and  Germany  argued 
strongly  against  non-SNs  being  able  to  request  assistance 
from  the  CCD-COE  or  benefiting  from  developments  resulting 
from  work  conducted  at  the  CCD-COE.  However,  both  NATO 
SACT  and  Estonia  were  adamant  that  the  CCD-COE  would  serve 
to  benefit  all  members  of  the  Alliance  and  NATO  partner 
nations,  on  a case  by  case  basis  through  agreements,  as 
well . 

1.10.  (U)  At  the  conclusion  of  the  conference,  participants 
agreed  to  a general  time  frame  for  finalizing  the 
agreement.  The  SNs  agreed  to  submit  staffing  commitments 
to  the  CCD-COE  by  the  end  of  February  2008.  The  formal  MOU 
signing  will  then  take  place  in  May  2008,  with 
accreditation  by  the  NATO  occurring  in  November  or  December 
12008.  The  GOE  hopes  to  have  the  CCD-COE  fully  accredited, 
staffed  and  operational  by  January  2009. 


11_11.  (SBU)  The  U.S.  status  as  an  observer  and  not  an  SN  at 
the  conference  sparked  considerable  discussion  among 
participants.  Representatives  from  Lithuania,  Spain  and 
Poland  specifically  asked  whether  the  United  States  intends 
to  sponsor  the  CCD-COE . The  Spanish  representative  noted 
that  U.S.  participation  as  a SN  would  lend  credibility  to 
the  CCD-COE.  The  Polish  representative  said  he  believed 
the  U.S.'s  quick  decision  to  send  an  expert  had  given 
'energy  and  impetus  to  the  project'  and  had  encouraged 
other  Allies  to  follow  suit. 

Comment 


112.  (SBU)  Post  understands  that  it  has  not  yet  been  decided 
if  the  United  States  will  become  a SN  of  Estonia's  CCD-COE. 
In  our  view,  there  would  be  several  significant  benefits  to 
sponsorship : 

--  The  Estonian  CCD  has  the  potential  to  become  an 
effective  tool  in  NATO's  efforts  to  institute  a coordinated 
cyber  policy  and  help  to  ensure  NATO  and  Allies  are  capable 
of  defending  themselves  against  cyber  attacks. 

--  A well  supported  CCD-COE  could  be  useful  to  NATO  and 
U.S.  interests  in  helping  to  implement  NATO's  cyber  defense 
policy. 

— Cyber  security  is  an  ideal  niche  for  Estonia  within 
NATO.  Internationally,  Estonia  is  widely  acknowledged  as  a 
leader  in  the  high-tech  industry  and  Internet  innovation. 

Its  small,  highly  educated  and  technologically  savvy 
population  is  well  suited  for  specializing  in  development 
of  NATO's  cyber  dimension.  U.S.  sponsorship  would 
demonstrate  our  support  for  Estonia's  efforts  to  take  a 
leadership  role  in  this  area. 

— U.S.  participation  will  increase  the  potential  for 
success  of  the  CCD-COE.  Other  Allies  will  likely  follow 
the  U.S.  lead  regarding  support  for  the  Cyber  Center. 

END  COMMENT. 

11_13.  (U)  This  cable  was  cleared  by  USNATO. 


DECKER 


